Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 00:48

General

  • Target

    77f8445a2e02ac72e0559545a3a69d758d3853866a55061efe6baacfe74cd1a6.exe

  • Size

    546KB

  • MD5

    913c321e4f063c890c087c9f77512b26

  • SHA1

    be2290402c2f0cdc75e246036a2f88391b51c554

  • SHA256

    77f8445a2e02ac72e0559545a3a69d758d3853866a55061efe6baacfe74cd1a6

  • SHA512

    73956938feae96424b2c09966c27a194d165aa7cd9ef324beb78ed1cbc363be603f6a591d5673cd60e7b2212a806edf254528d2211fbc3febbfc03526330be93

  • SSDEEP

    12288:QMrey90aCLJYjBVScs2++a3Uh5ooestOwLFYqbV:ey0+a3UfoSBiYV

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

real

C2

193.233.20.31:4125

Attributes
  • auth_value

    bb22a50228754849387d5f4d1611e71b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77f8445a2e02ac72e0559545a3a69d758d3853866a55061efe6baacfe74cd1a6.exe
    "C:\Users\Admin\AppData\Local\Temp\77f8445a2e02ac72e0559545a3a69d758d3853866a55061efe6baacfe74cd1a6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1268.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1268.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3076
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6465.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6465.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4588.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4588.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4968
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1336
          4⤵
          • Program crash
          PID:892
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si691594.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si691594.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1468
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4968 -ip 4968
    1⤵
      PID:1492

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Modify Existing Service

    1
    T1031

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    3
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si691594.exe
      Filesize

      175KB

      MD5

      41707338e1e2d868aa699ac0dd2e77b0

      SHA1

      36e0dfba09f9fb409faf0f9a99217d0d0c524b82

      SHA256

      8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

      SHA512

      80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si691594.exe
      Filesize

      175KB

      MD5

      41707338e1e2d868aa699ac0dd2e77b0

      SHA1

      36e0dfba09f9fb409faf0f9a99217d0d0c524b82

      SHA256

      8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

      SHA512

      80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1268.exe
      Filesize

      404KB

      MD5

      acbaaa9f2b9139160ceffdef1d18a7b0

      SHA1

      4f81a775cd8bd78a25ec6c7b5d08593ce296943a

      SHA256

      931e5d4bde9d3ea1c4b69a12805b42812927a5fd7f57a767a94d94229799c4fc

      SHA512

      89e9c288c4bf1ef3d66db665eb359978dbbb6f91d255822c5790e39e822c38685f5de6154356a799630ebfcf84c7c1ba5a42eb63e2b6102929c5fe0e7acebbab

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio1268.exe
      Filesize

      404KB

      MD5

      acbaaa9f2b9139160ceffdef1d18a7b0

      SHA1

      4f81a775cd8bd78a25ec6c7b5d08593ce296943a

      SHA256

      931e5d4bde9d3ea1c4b69a12805b42812927a5fd7f57a767a94d94229799c4fc

      SHA512

      89e9c288c4bf1ef3d66db665eb359978dbbb6f91d255822c5790e39e822c38685f5de6154356a799630ebfcf84c7c1ba5a42eb63e2b6102929c5fe0e7acebbab

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6465.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6465.exe
      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4588.exe
      Filesize

      358KB

      MD5

      2b310e0eed6a5c1ac8da1d9fe29cc939

      SHA1

      f67438c9b1528aee72092e32e2161bccbab5ce71

      SHA256

      fed06dc9d8be8e851cac1e8a0a5a3a14e19ff62c3edfd663902d40c6df52a50b

      SHA512

      f5661af3a630d52b1e39676d505c221670b4eb8a2afcf44182f9267001ca0a3908ae0191d7db2a7f4d2735fef52f67cf48a2c71129ed02898b9c8f165d0271f9

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4588.exe
      Filesize

      358KB

      MD5

      2b310e0eed6a5c1ac8da1d9fe29cc939

      SHA1

      f67438c9b1528aee72092e32e2161bccbab5ce71

      SHA256

      fed06dc9d8be8e851cac1e8a0a5a3a14e19ff62c3edfd663902d40c6df52a50b

      SHA512

      f5661af3a630d52b1e39676d505c221670b4eb8a2afcf44182f9267001ca0a3908ae0191d7db2a7f4d2735fef52f67cf48a2c71129ed02898b9c8f165d0271f9

    • memory/1468-1085-0x0000000000C10000-0x0000000000C42000-memory.dmp
      Filesize

      200KB

    • memory/1468-1086-0x00000000057E0000-0x00000000057F0000-memory.dmp
      Filesize

      64KB

    • memory/1748-147-0x00000000005C0000-0x00000000005CA000-memory.dmp
      Filesize

      40KB

    • memory/4968-189-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-201-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-155-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB

    • memory/4968-156-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB

    • memory/4968-157-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB

    • memory/4968-158-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-159-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-161-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-163-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-165-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-167-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-169-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-171-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-173-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-175-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-177-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-179-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-181-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-183-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-185-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-187-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-153-0x0000000004CF0000-0x0000000005294000-memory.dmp
      Filesize

      5.6MB

    • memory/4968-191-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-193-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-195-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-197-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-199-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-154-0x00000000008B0000-0x00000000008FB000-memory.dmp
      Filesize

      300KB

    • memory/4968-203-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-207-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-205-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-209-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-211-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-213-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-215-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-217-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-219-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-221-0x00000000052E0000-0x000000000531E000-memory.dmp
      Filesize

      248KB

    • memory/4968-1064-0x0000000005320000-0x0000000005938000-memory.dmp
      Filesize

      6.1MB

    • memory/4968-1065-0x00000000059C0000-0x0000000005ACA000-memory.dmp
      Filesize

      1.0MB

    • memory/4968-1066-0x0000000005B00000-0x0000000005B12000-memory.dmp
      Filesize

      72KB

    • memory/4968-1067-0x0000000005B20000-0x0000000005B5C000-memory.dmp
      Filesize

      240KB

    • memory/4968-1068-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB

    • memory/4968-1070-0x0000000005E10000-0x0000000005E76000-memory.dmp
      Filesize

      408KB

    • memory/4968-1071-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB

    • memory/4968-1072-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB

    • memory/4968-1073-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB

    • memory/4968-1074-0x00000000064D0000-0x0000000006562000-memory.dmp
      Filesize

      584KB

    • memory/4968-1075-0x00000000065D0000-0x0000000006792000-memory.dmp
      Filesize

      1.8MB

    • memory/4968-1076-0x00000000067A0000-0x0000000006CCC000-memory.dmp
      Filesize

      5.2MB

    • memory/4968-1077-0x0000000006E20000-0x0000000006E96000-memory.dmp
      Filesize

      472KB

    • memory/4968-1078-0x0000000006EA0000-0x0000000006EF0000-memory.dmp
      Filesize

      320KB

    • memory/4968-1079-0x0000000002850000-0x0000000002860000-memory.dmp
      Filesize

      64KB